CDS Access Control (DCL): Feingranulare Berechtigungen

@EndUserText.label: 'Access Control für Bestellungen'
@MappingRole: true
define role ZI_Order {
  grant select on ZI_Order
  where ( CompanyCode ) = aspect pfcg_auth( Z_BUKRS, BUKRS, ACTVT = '03' );
}

@EndUserText.label: 'Sales Order Access'
@MappingRole: true
define role ZI_SalesOrder {
  grant select on ZI_SalesOrder
  where ( SalesOrganization ) =
    aspect pfcg_auth( V_VBAK_VKO, VKORG, ACTVT = '03' );
}

aspect pfcg_auth(
  <Berechtigungsobjekt>,
  <Feld im Objekt>,
  <Aktivität> = '<Wert>'
)

@MappingRole: true
define role ZI_Material {
  grant select on ZI_Material
  where ( Plant, MaterialType ) =
    aspect pfcg_auth( M_MATE_WRK, WERKS, MTART, ACTVT = '03' );
}

define role ZI_PurchaseOrder {
  grant select on ZI_PurchaseOrder
  where ( CompanyCode ) = aspect pfcg_auth( F_BKPF_BUK, BUKRS, ACTVT = '03' )
    and ( PurchasingOrganization ) = aspect pfcg_auth( M_BEST_EKO, EKORG, ACTVT = '03' );
}

define role ZI_Document {
  grant select on ZI_Document
  where ( DocumentType ) = aspect pfcg_auth( Z_DOCTYPE, BSART, ACTVT = '03' )
     or ( DocumentType ) = 'PUBLIC';
}

define role ZI_Order {
  grant select on ZI_Order
  where (
    ( CompanyCode ) = aspect pfcg_auth( F_BKPF_BUK, BUKRS, ACTVT = '03' )
    and ( ( SalesOrg ) = aspect pfcg_auth( V_VBAK_VKO, VKORG, ACTVT = '03' )
          or Status = 'RELEASED' )
  );
}

@AccessControl.authorizationCheck: #CHECK
define view entity ZI_OrderItem
  as select from zorder_item
  association [1..1] to ZI_Order as _Order
    on $projection.OrderID = _Order.OrderID
{
  key OrderID,
  key ItemNumber,
  Material,
  Quantity,
  _Order
}

define role ZI_OrderItem {
  grant select on ZI_OrderItem
  where ( _Order.CompanyCode ) =
    aspect pfcg_auth( F_BKPF_BUK, BUKRS, ACTVT = '03' );
}

define role ZI_OrderItemSchedule {
  grant select on ZI_OrderItemSchedule
  where ( _OrderItem._Order.CompanyCode ) =
    aspect pfcg_auth( F_BKPF_BUK, BUKRS, ACTVT = '03' );
}

@EndUserText.label: 'User Country Aspect'
define abstract entity ZA_UserCountry
{
  Country : land1;
}

define role ZI_Customer {
  grant select on ZI_Customer
  where Country = aspect ZA_UserCountry.Country;
}

define role ZC_SalesOrder {
  grant select on ZC_SalesOrder
  where inherits_all;
}

define role ZI_Employee {
  grant select on ZI_Employee
  where PersonnelArea IN
    aspect pfcg_auth( PLOG, PERSA, ACTVT = '03' )
    or EmployeeID = $session.user;
}

define role ZI_PersonalData {
  grant select on ZI_PersonalData
  where CreatedBy = $session.user
     or Visibility = 'PUBLIC';
}

@AccessControl.authorizationCheck: #CHECK
define view entity ZI_SalesOrder
  as select from zsalesorder
{
  key SalesOrderID,
  SalesOrganization,
  Customer,
  NetAmount
}

" Mit privilegiertem Zugriff (DCL wird ignoriert)
SELECT * FROM zi_salesorder
  WITH PRIVILEGED ACCESS
  INTO TABLE @DATA(lt_orders).

" Normaler Zugriff (DCL wird angewendet)
SELECT * FROM zi_salesorder
  INTO TABLE @DATA(lt_orders_filtered).

ZC_SalesOrder (Projection)
    ↓ Prüft eigene DCL (kann inherit nutzen)
ZI_SalesOrder (Interface View)
    ↓ Prüft eigene DCL
ZSALESORDER (Tabelle)

-- Interface View: Volle Berechtigungsprüfung
define role ZI_SalesOrder {
  grant select on ZI_SalesOrder
  where ( SalesOrg ) = aspect pfcg_auth( V_VBAK_VKO, VKORG, ACTVT = '03' );
}

-- Projection View: Erbt von Interface View
define role ZC_SalesOrder {
  grant select on ZC_SalesOrder
  where inherits_all;
}

METHOD get_sales_orders.
  " Manuell Berechtigung prüfen
  AUTHORITY-CHECK OBJECT 'V_VBAK_VKO'
    ID 'VKORG' FIELD lv_sales_org
    ID 'ACTVT' FIELD '03'.

  IF sy-subrc <> 0.
    RAISE EXCEPTION TYPE cx_no_authority.
  ENDIF.

  " Dann Daten lesen
  SELECT * FROM zsalesorder
    WHERE vkorg = @lv_sales_org
    INTO TABLE @rt_orders.
ENDMETHOD.

METHOD get_sales_orders.
  " DCL prüft automatisch - nur berechtigte Daten zurückgegeben
  SELECT * FROM zi_salesorder
    INTO TABLE @rt_orders.
ENDMETHOD.

" Generated SQL mit DCL-Bedingungen anzeigen
DATA(lo_sql) = cl_sql_statement=>create_for_cds_entity(
  iv_cds_entity = 'ZI_SALESORDER' ).

DATA(lv_sql) = lo_sql->get_native_sql( ).

-- Gut: Feld mit Index
define role ZI_Order {
  grant select on ZI_Order
  where ( CompanyCode ) = aspect pfcg_auth( F_BKPF_BUK, BUKRS, ACTVT = '03' );
}

-- Schlecht: Komplexe Ausdrücke ohne Index
define role ZI_Order {
  grant select on ZI_Order
  where SUBSTRING( OrderNumber, 1, 2 ) = 'AB';
}

-- Performance: Kurze Pfade bevorzugen
where _Order.CompanyCode = ...

-- Weniger performant: Tiefe Pfade
where _OrderItem._Order._Customer._Country.Region = ...

define role ZI_MyDocuments {
  grant select on ZI_MyDocuments
  where CreatedBy = $session.user
     or AssignedTo = $session.user;
}

define role ZI_Announcement {
  grant select on ZI_Announcement
  where Visibility = 'PUBLIC'
     or ( Visibility = 'PRIVATE' and Owner = $session.user );
}

define role ZI_Campaign {
  grant select on ZI_Campaign
  where ValidFrom <= $session.system_date
    and ValidTo >= $session.system_date;
}